Optimal eavesdropping in quantum cryptography with six states 
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A generalization of the quantum cryptographic protocol by Bennett and Brassard is discussed, 
using three conjugate bases, i.e. six states. By calculating the optimal mutual information between 
sender and eavesdropper it is shown that this scheme is safer against eavesdropping on single qubits 
than the one based on two conjugate bases. We also address the question for a connection between 
the maximal classical correlation in a generalized Bell inequality and the intersection of mutual 
informations between sender/receiver and sender/eavesdropper. 
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0\ ' In 1984 Bennett and Brassard suggested a quantum cryptographic protocol, in the following called BB84, which 
On , enables two parties to establish a secret key, using principles of quantum mechanics. In this scheme the sender of the 
quantum information, usually called Alice, transmits quantum bits in the basis | 0), 1 1) or the conjugate basis | 0), | 1), 
defined by 
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■ to the receiver Bob, who performs measurements in these bases. After classical communication via a public channel 
Qv^ I a secret key can be established by using only those cases in which the bases of Alice and Bob coincide. 

^-H ' In this paper we want to discuss a generalized scheme which is based on the use of three rather than two bases. 
The third one used in addition to the previous ones is denoted by | 0), | 1) and defined by 

in . 
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^ ^ In the Bloch vector picture a density matrix g is written as £i = ^(1 + s • ct), with s being the Bloch vector and a 
^ , the Pauli matrices. The six states can be viewed as Bloch vectors pointing along the positive and negative x-, y- and 
^ z-directions. Alice sends one out of these, denoted as | V'™): with equal probability. 

Ci Such a scenario is a straightforward extension of the traditional protocol and its possibility has been mentioned 

^ ' at various occasions Our main purpose is to point out that this generalized scheme is principally more secure 
than the one in This is due to the fact that the optimal strategy an eavesdropper, traditionally called Eve, can 
design to gather information by performing some unitary transformation on the quantum bit in transit, gives her in 
our scenario less information for a fixed disturbance of Bob's qubit. As Alice increases the set of inputs it is more 
difficult for Eve to learn something in transit. 

■ It was conjectured in and shown in [Q that in the BB84 scenario the disturbance corresponding to Bob and Eve 
possessing the same information with respect to Alice exhibits a connection to the CHSH inequality. After deriving 
Eve's optimal strategy we will ask whether in the generalized protocol the crossing point between the two relevant 
mutual informations has a connection to a generalized Bell inequality where Alice and Bob use the observables • a"" 
and 6i • (t'', {i = 1, 2, n}, respectively, with the Bloch vectors Oi, hi spanning not only a plane, but the Bloch sphere. 

After this introduction and outline of the paper let us derive the eavesdropping strategy that is optimal with respect 
to the mutual information between Alice and Eve, I^^ . We do not consider collective or coherent attacks, but only 
interaction with single qubits. The most general unitary transformation Eve can design is of the form 

Umx) = VF\Q)\A) + ^/T^\l)\B) (3) 



U\l)\X) = ^\l)\C)+Vl^mD) . (4) 

The first qubit is the one sent to Bob and acted on by Eve. Eve's initial state is | X), and \ A) ,\ B) ,\ C) ,\ D) refer to 
her normalized states after the interaction. It was shown in |^ that it is sufficient for Eve to use two qubits in order 
to extract the maximal information. The fidelity of Bob's bit is F and is taken to be in the interval 1/2 < < 1. 

We assume Eve to be clever enough to treat all six possible states in the same way (i.e. with same disturbance for 
Bob) - otherwise Alice and Bob could find out about her existence by comparing error rates in different bases. This 
assumption results in three constraints which the scalar products of Eve's states have to fulfill: 
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{B\D)=Q, 
i?e(C|A>=2-l , 
{A\B) + {D\C)^0. (5) 

Unitarity of the matrix U means 

{A\D) + {B\C)^0. (6) 
The mutual information between AUce and Bob is given by 

/^^ = i + i:>iog7:> + (i-7:>)iog(i-7:>) , (7) 

where D is the disturbance of Bob's qubit, defined by 

i^ = l-F=l-(^/'"|^?^|V'") , (8) 

and is the right hand side of equations (||) and traced over Eve's bits. Ah logarithms are taken to base 2. By 
construction Bob's disturbance is the same no matter which state was sent by Alice. The procedure to calculate the 
mutual information between Alice and Eve is more involved. We expand 

I A) = aA\ 00) + Pa\ 10) + ja\ 01) + Sa\ H) , (9) 
where the complex coefficients have to satisfy 

\aA\' + \pA\^ + \jA\^ + \SA\' = 1 (10) 

and similarly for \ B),\C),\ D). We are free to choose | B) as one of the four basis vectors, e.g. \ B) = \ 00) and 
can fulfill the first constraint in equation (|^) by setting \D) = 1 11), without loss of generality. We then find for the 
mutual information the form 

+ l(r[F\ aA P + (1 - F), F\ ac P] + 

T[F\l3Af,F\f3cf] + 
r[F\jA\^F\jc\'] + 

T[F\SA\^ + {l~F),F\dc\^]) , (11) 

where we define 

T[x,y] ^ xlogx + y\ogy - {x + y) log{x + y) . (12) 

Note that —t[x, 1 — x] is the entropy function. Equation (^Tj) is the mutual information which Eve reaches when 
postponing the measurement until she learns which basis was used by listening to the public channel. 

The task is to maximize I^^ with the constraints of eq. (^ and (||) . The method of Lagrange multipliers leads to 
a set of equations which can not be simultaneously fulfilled unless aA = etc =^ and 6a — 5c — 0. This means that 
the best solution for Eve is to use states such that {A \B) = = (C \D), which one would have expected. 

Now we have only two parameters left. Pa and Pci and can write 

/^^^ = 1 + 1^f{t[\ Pa I Pc + r[(l - | Pa P), {l-\Pc H]) , (13) 

which is a concave function. Here we have used 

T[Fx,Fy]=FT[x,y] . (14) 

It is straightforward to write down the system of equations which has to be fulfilled in order to maximize I^^ . Due 
to their high symmetry one can find one solution easily, namely 

\Pa\' = 1-\Pc\\ (15) 

and thus 

I^^^I + F-t[\Pa\\1-\Pa\']. (16) 
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By checking the higher derivatives one confirms that this is a maximum, which is, due to concavity, the absolute 
maximum. Inserting into the second Une of eq. (||) allows us to find the 'best' relative phase between | A) and | C) 
and thus leads to the solution for the highest mutual information that Eve can extract from measuring her two qubits, 

/■^^ - 1 + (1 - D) {f{D) log f{D) + (1 - f{D)) log(l - fiD))} , 
1 



fiD) = ^i^l + ^—^^D{2-3D)j . (17) 

This function is shown in figure |l|, where we also give the corresponding mutual information for BB84, taken from [Q, 
for the purpose of comparison. {I^^ is identical in both cases.) Note that our curve lies everywhere below the one 
for the BB84 case. The six state protocol is therefore more secure against eavesdropping on single qubits. 

In our case both bits of Eve carry mutual information, unlike the one described by If she would either measure 
only one of her two bits, or if she would use a 1-bit probe from the beginning, her maximal information would be 

jAE,iMt ^ ^ ^ f,{D)\ogh{D) + (1 - h{D))log{l - h{D)) , 



h{D) = \[l + D+^D{2-iD)] , (18) 
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which is the lowest curve in figure |l|. The calculation for the 1-bit probe follows the same line as explained above for 
the 2-bit probe, but is less involved. Note that in order to maximize her mutual information in the six-state scheme 
Eve necessarily needs two qubits as resource, whereas for BB84 a 1-bit probe is sufhcient to reach optimality |^. 

It is worth mentioning that the optimal unitary transformation which leads to equation ( [TtI ) disturbs all Bloch 
vectors in the same way, not only the six states used by Alice, and allows Eve to gain the same information in all possible 
bases. In other words: the optimal eavesdropping action for six states is shown to be a universal transformation. This 
means that using a bigger number of states cannot increase security. The gain in security described in this paper is 
due to the fact that the three bases are spanning the full Bloch sphere, as opposed to the case of BB84 where only a 
two-dimensional plane is spanned. 

The scheme described in 01 can also be realized by Alice and Bob sharing a singlet, i.e. a maximally entangled 
state. This was discussed in^,||. In this case, which we will consider for the rest of this article, Alice and Bob can 
test for eavesdropping by calculating S, the correlation coefficient in the CHSH inequality. Without any disturbance 
of Bob's bit they will find 15*1 = 2\/2. This value is decreased when Eve interacts unitarily with Bob's bit. As 
was shown in [Q, the intersection of the two curves for I"^^ and I^^ corresponds to | 5 | =2, i.e. at disturbances 
D>\{1~ 1/V2) the CHSH inequahty (between Ahce and Bob) is not violated. 

The natural question arises whether the corresponding intersection for the generalized scheme is related to a 
generalized Bell inequality. In the six-state protocol the reduced density matrix of Alice and Bob after Eve's interaction 
reads 

/ D \ 

AB^\ \ l-D 2D-1 

V D ) 

where the matrix elements are written in the order 00,10,01,11. For any number of measurement directions that Alice 
and Bob can use to test a Bell inequality we find 

I S{D) \ = \S,\-{l~2D) (20) 

where Sq denotes the correlation for I? = 0, i.e. the undisturbed singlet. Thus in our case the measurement directions 
that are optimal for the singlet are also optimal for D i.e. a mixed state. This does not hold in general We 
will refer to the disturbance where | S{D) \ = \Sc\, i.e. where S reaches the classical limit, as Dc- 

Let us first look at the case where Alice and Bob are using two measurement directions each that do not necessarily 
lie in a plane. Here the inequality for a model with local hidden variables reads | 5' | < 2. 

We can make use of Cirel'son's inequality ||l^ in which the norm of the operator 

C ^ ai ■ a"^ ®hi ■ + d2 ■ d'' ®bi ■ a'' + d2 ■ a°- ®b2 ■ - di ■ a°- ®b2 ■ a'' (21) 

is shown to obey ||C|| < 2^/2. (Here di refer to Alices directions of measurement and hi to those of Bob.) This 
means that the maximal value the quantum correlation can take is | 5^ | = 2^/2, no matter whether the measurement 
directions span a plane or a sphere. This value is reached in the CHSH scenario. One can intuitively understand this 
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in the following way: in order to maximize the sum of scalar products of the measurement directions their relative 
angles have to be as small as possible, i.e. they have to lie on a great circle of the sphere. Thus we cannot find a ratio 
for I Sq/Sc I that is higher than and therefore we cannot establish a Bell inequality in the sphere that corresponds 
to the intersection of I^^ with I^^ for the generalized protocol, because here Dc is larger than in BB84. 

We can generally exclude such a correspondence for n measurements by each party, i.e. chained Bell inequalities 
PI : the inequality reads now \ S\ < 2n — 2. The relevant operator C for this case can be written as a sum of operators 
of the form used in Cirel'son's inequality which we call Ci, C„-i. Due to the inequality 

lldl = ||Ci + C2 + ... + C„-i|| < + + 

<(n-l)-2\/2 (22) 

we know an upper limit of the quantum correlation. Thus we find | S'g/S'c | < V2 as in the paragraph above and can 
generally exclude the mentioned connection. 



Note that inequalities like the original Bell inequality and a recent suggestion by Ardehali |12| where two directions 
of measurement coincide cannot be used for our purpose: the eavesdropping interaction causes the expectation value 
{a ■ d°' ®a ■ a'') to be smaller than 1 if Z? > 0. 

To summarize, we have discussed a quantum cryptographic protocol based on six quantum states and shown that it 
is safer against eavesdropping on single qubits than the BB84 scheme, because Eve's maximal mutual information is 
smaller than in the BB84 scenario. Furthermore, in order to reach the maximal mutual information the eavesdropper 
needs to use a two-bit probe and thus has to perform a more complicated transformation than in BB84. If her resource 
consists of only one qubit, she gains even less information. We have to mention some practical disadvantage: in order 
to establish a key one will here loose 2/3 of the signals rather than 1/2 in the BB84 scenario, when using equal 
probabilities for all states. We have also shown that the best way to test a CHSH inequality is to use measurement 
directions that lie in a plane. In the six-state protocol there is no natural relation between the classical limit of a Bell- 
type correlation coefficient and the intersection of the information curves. We hope that this cryptographic scheme 
may reach practical relevance in the light of recent suggestions to produce maximally entangled pairs of distant atoms 



L3[, see also |14 
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FIG. 1. Maximal mutual information / between Alice and Eve as function of Bob's disturbance D. The upper curve holds 
for BB84 Q and is shown for the purpose of comparison. The lower curves refer to the six-state protocol. Their analytic forms 
are shown in equations (]l7|) and ([L8|). The mutual information between Alice and Bob is in both scenarios given by the curve 



5 



